# GET /api/v1/app/{appId}/profile/results

**Get latest profile scan result**

Retrieves the most recent profile scan result for an application with testability analysis.

> Requires `read:scan` permission.

## Parameters

- `appId` (in: path, string<uuid>) *(required)* — UUID identifier for this StackHawk Application.

## Responses

### 200 — OK

#### application/json

- `assets` (scanresults.AssetInventory)
  - `assetSummary` (scanresults.AssetSummary)
    - `dynamicContent` (scanresults.AssetCategoryCount)
      - `count` (integer<int32>)
      - `sampleUrls` (string[])
      - `totalSizeBytes` (integer<int64>)
    - `scripts` (scanresults.AssetCategoryCount)
      - `count` (integer<int32>)
      - `sampleUrls` (string[])
      - `totalSizeBytes` (integer<int64>)
    - `staticMedia` (scanresults.AssetCategoryCount)
      - `count` (integer<int32>)
      - `sampleUrls` (string[])
      - `totalSizeBytes` (integer<int64>)
  - `buildStrategy` (string) — Build analysis
  - `optimizationNotes` (string[])
  - `totalAssets` (integer<int32>) — Summary
  - `totalSizeBytes` (integer<int64>)
- `authConfigPresent` (boolean)
- `authMarkers` (scanresults.AuthMarker[]) — Authentication markers detected
  - `confidence` (string)
  - `evidence` (string)
  - `signals` (scanresults.AuthSignal[])
    - `detail` (string)
    - `signalType` (string)
  - `type` (string)
- `classification` (string) — Application classification
- `discoveredOpenapiSpecPath` (string) — Path where OpenAPI/Swagger spec was discovered (e.g., "/api/v3/api-docs") Empty if no spec was discovered
- `paths` (scanresults.PathDiscovery)
  - `authProtectedCount` (integer<int32>)
  - `dynamicCount` (integer<int32>)
  - `samplesAuthProtected` (scanresults.PathInfo[])
    - `authEvidence` (string)
    - `method` (string)
    - `url` (string)
  - `samplesDynamic` (scanresults.PathInfo[])
    - `authEvidence` (string)
    - `method` (string)
    - `url` (string)
  - `samplesStatic` (scanresults.PathInfo[]) — Sample paths (up to 10 each for UI display)
    - `authEvidence` (string)
    - `method` (string)
    - `url` (string)
  - `staticCount` (integer<int32>)
  - `total` (integer<int32>) — Total counts
- `recommendations` (string[]) — Actionable recommendations
- `scanId` (string)
- `score` (string) — Testability assessment
- `scoreReasons` (string[])
- `timestamp` (integer<int64>)

### 401 — Unauthorized

- (no body)